Microsoft disrupts USDT-funded phishing network hitting 75,000 firms

Key points

• Microsoft and Health-ISAC seized domains tied to YAM Store, CoGUI and Iron Man on Oct. 14
• Services targeted 75,000+ organizations in 150+ countries since January, Microsoft says
• Operators accepted USDT, Ethereum and reportedly USDC; TRM Labs helped enable asset freezes
• Amount of frozen assets has not been disclosed

Microsoft and the health-sector security group Health-ISAC said on Oct. 14 that they obtained a US court order to seize and redirect domains tied to three Chinese-language cybercrime services that sold phishing tools and stolen accounts. According to Microsoft, the services, YAM Store, CoGUI and Iron Man, have targeted more than 75,000 organizations in over 150 countries since January, and accepted payment in cryptocurrency including Tether’s USDT.

The action was reported by CryptoSlate and detailed in Microsoft’s security blog post.

What Microsoft says the services did

Microsoft linked the three services to more than one billion malicious messages this year, including more than 750 million aimed at Microsoft customers, according to figures published by Microsoft and repeated by TRM Labs. Reports said the campaigns generated tens of millions of dollars for the operators.

YAM Store sold fraudulently obtained Microsoft and Google accounts, cloud resources and hosting. Some operators revived expired domains belonging to nonprofits and educational organizations, then used them to obtain Microsoft 365 accounts for resale. CoGUI and Iron Man supplied ready-made phishing pages and messages impersonating banks, retailers, transport authorities and government agencies. Microsoft and Resecurity identified more than 2,300 Iron Man templates.

Microsoft said it disabled more than 20,000 accounts tied to YAM Store and continues to block more than 100,000 impersonation and fraud domains.

The role of USDT and other crypto

Microsoft’s investigation found that YAM Store and affiliated phishing-kit businesses took payment in crypto, including USDT and Ethereum. CryptoSlate reported that YAM Store’s storefront accepted USDT on the Tron network alongside Alipay and WeChat Pay, and that Cloudflare said buyers could also pay with USDC.

Blockchain analytics firm TRM Labs said its intelligence was key to locating and enabling the freeze of assets associated with the group, according to its blog post. TRM did not disclose the amount, currency or blockchain involved, so the size of the freeze is unclear.

Partners and what happens next

The investigation began after Japan’s National Police Agency alerted Microsoft to scams aimed at consumers and businesses late last year, according to CryptoSlate. Investigators traced the campaigns to a Chinese-language marketplace. Partners included Japan’s police and Cybercrime Control Center, Oracle, Proofpoint, Resecurity, Cloudflare and US law enforcement. The Record reported that the order came from a federal court in the Southern District of Florida.

Cloudflare suspended accounts, disabled Workers projects that supported phishing pages, banned hundreds of associated domains and placed warning pages in front of malicious links it could not seize. Microsoft said related infrastructure is still being removed.

Disruptions of this kind may not be permanent. CryptoSlate noted that suppliers could replace seized domains and compromised accounts, and that some registrars operate in jurisdictions where legal seizures are difficult.